If you’re studying for the ISC2 Certified in Cybersecurity (CC) exam, Domain 2 — Business Continuity, Disaster Recovery, and Incident Response — might only account for 10% of the 100-question exam, but don’t let that percentage fool you. These concepts underpin how organizations survive real-world threats, and the exam absolutely expects you to apply them in scenario-based questions. This guide breaks down every key concept in ISC2 CC Domain 2 so you can walk into your 120-minute exam with confidence.
What Is Domain 2 Testing, Exactly?
Domain 2 of the ISC2 CC exam covers three tightly related disciplines:
- Business Continuity Planning (BCP) — keeping critical business functions running during and after a disruption
- Disaster Recovery Planning (DRP) — restoring IT systems and data after a catastrophic event
- Incident Response (IR) — detecting, containing, and learning from security incidents
At first glance these sound similar, but the exam tests your ability to distinguish between them. BCP is strategic and organization-wide. DRP is tactical and technology-focused. Incident Response is reactive and process-driven. Knowing when each applies is critical.
Business Continuity Planning (BCP): The Big Picture
A Business Continuity Plan ensures that an organization can maintain or quickly resume critical business functions during a disruption — whether that’s a ransomware attack, a power outage, or a natural disaster. BCP is proactive: it’s built before anything goes wrong.
Business Impact Analysis (BIA): Where BCP Starts
Before you can build a continuity plan, you need to know what matters most. That’s exactly what a Business Impact Analysis (BIA) does. A BIA identifies critical business functions, quantifies the potential impact of disruptions to those functions, and determines recovery priorities and time frames. Think of it as the foundation of your entire BCP — without it, you’re guessing at priorities rather than making data-driven decisions.
The BIA produces key outputs that feed directly into your recovery planning, most importantly:
- Recovery Time Objective (RTO) — the maximum acceptable length of time a system can be down after a failure
- Recovery Point Objective (RPO) — the maximum acceptable amount of data loss measured in time (e.g., “we can’t lose more than 4 hours of transactions”)
RTO vs. RPO: A Critical Distinction
The CC exam loves to test RTO and RPO in scenario-based questions. Here’s how to keep them straight:
- RTO answers: “How long can we be down?” — this drives your recovery infrastructure decisions
- RPO answers: “How much data can we afford to lose?” — this drives your backup frequency decisions
A mission-critical hospital system might have an RTO of 15 minutes and an RPO of near-zero. A small internal wiki might tolerate an RTO of 48 hours and an RPO of 24 hours. The exam expects you to understand these trade-offs, not just the definitions.
Disaster Recovery Planning (DRP): Getting Systems Back Online
Where BCP focuses on the business, Disaster Recovery focuses on technology — specifically restoring IT systems, applications, and data after a disruptive event. Your DRP is the technical playbook that makes your BCP possible.
Backup Strategies You Need to Know
The exam tests three core backup types:
- Full backup — complete copy of all selected data; slowest to create, fastest to restore
- Incremental backup — backs up only data changed since the last backup (any type); fast to create, slower to restore (requires full + all incrementals)
- Differential backup — backs up all data changed since the last full backup; moderate creation time, faster restore than incremental (requires only full + latest differential)
Understanding these trade-offs between backup window time and restore time is exactly the kind of nuanced knowledge the CC exam rewards.
Recovery Sites
The ISC2 CC exam also covers alternate site strategies:
- Hot site — fully operational duplicate facility; highest cost, lowest RTO
- Warm site — partially equipped facility that needs some setup; moderate cost and RTO
- Cold site — basic facility with power and connectivity but no pre-installed equipment; lowest cost, highest RTO
Incident Response: The NIST Lifecycle
The ISC2 CC exam aligns closely with the NIST incident response lifecycle, and you need to know the four phases in order. This isn’t just trivia — the exam presents scenarios and asks which phase you’re in or what action you should take next.
The Four NIST IR Phases
- Preparation — building the IR team, tools, and processes before an incident happens. This is the most important phase because everything else depends on it.
- Detection and Analysis — identifying that an incident has occurred, gathering evidence, and determining its scope and severity.
- Containment, Eradication, and Recovery — stopping the spread, removing the threat, and restoring systems to normal operation.
- Post-Incident Activity — documenting lessons learned, updating processes, and improving defenses. Sometimes called the “lessons learned” phase.
A common exam trap is presenting the phases out of order and asking you to identify the correct sequence. Preparation always comes first — you can’t effectively respond to an incident you weren’t prepared to handle.
Test Your Knowledge
Let’s put these concepts to work with two practice-style scenarios similar to what you’ll encounter on the CC exam.
Scenario 1: A company’s BIA determines their e-commerce platform generates $75,000 per hour in revenue. Their RTO is set at 3 hours. What is the maximum potential revenue loss from downtime within that RTO window?
- A) $75,000
- B) $150,000
- C) $225,000
- D) $300,000
Answer: C — $225,000. Multiply hourly revenue ($75,000) by the RTO (3 hours) to get the maximum acceptable loss. The RTO defines the ceiling for downtime, so your recovery target directly caps your financial exposure. If recovery takes longer, losses exceed this figure.
Scenario 2: A security analyst discovers unusual outbound traffic patterns suggesting a data exfiltration attempt. The IR team isolates the affected systems and begins removing malware. Which NIST incident response phase are they currently in?
- A) Preparation
- B) Detection and Analysis
- C) Containment, Eradication, and Recovery
- D) Post-Incident Activity
Answer: C — Containment, Eradication, and Recovery. Isolating systems (containment) and removing malware (eradication) are both actions in phase three. Detection already occurred when the unusual traffic was identified — the team has moved past that phase.
Want more practice? Certcy has 110+ ISC2 CC questions like these — try them free.
Domain 2 Study Tips That Actually Work
- Draw the NIST lifecycle from memory. Write out all four phases with their key activities until it’s automatic — the exam will test the sequence.
- Always calculate, don’t estimate. RTO and RPO questions often involve straightforward math. Practice doing these calculations quickly under time pressure.
- Know the BIA’s role. Every BCP starts with a BIA. If an exam question asks “what should be done first in continuity planning,” BIA is almost always the answer.
- Distinguish BCP from DRP. BCP = business functions. DRP = IT systems. Both serve continuity, but they operate at different levels.
- Use scenario-based practice. Domain 2 questions rarely ask for simple definitions — they put you in situations and ask what to do. Practice with scenario questions every day.
Frequently Asked Questions
How much of the ISC2 CC exam is Domain 2?
Domain 2 — Business Continuity, Disaster Recovery, and Incident Response — accounts for 10% of the ISC2 CC exam. On a 100-question exam with a passing score of 700/1000, that translates to roughly 10 questions. While it’s the smallest domain by weight, these questions often involve multi-step reasoning and scenario analysis, so they’re not questions you want to walk into unprepared.
What’s the difference between RTO and RPO?
RTO (Recovery Time Objective) defines the maximum acceptable downtime — how long a system can be offline before the business impact becomes unacceptable. RPO (Recovery Point Objective) defines the maximum acceptable data loss — how far back your last good backup can be. Both values are determined by the Business Impact Analysis and directly shape your disaster recovery strategy. A low RTO requires robust failover infrastructure; a low RPO requires frequent backups.
Do I need to memorize the NIST incident response phases in order?
Yes — and more importantly, you need to understand why they’re in that order. The CC exam presents scenarios where you must identify the current phase or determine the correct next action. The sequence is: Preparation → Detection and Analysis → Containment, Eradication, and Recovery → Post-Incident Activity. Preparation is always first because it enables everything else. Post-Incident Activity (lessons learned) is always last because it informs future improvements.
Is the ISC2 CC exam hard to pass?
The CC exam requires a scaled score of 700 out of 1000 across 100 multiple-choice questions in 120 minutes. It’s designed for entry-level candidates with no prerequisites, but that doesn’t mean it’s easy. The questions are scenario-based and require applied understanding rather than rote memorization. Consistent daily practice with exam-style questions — especially across all five domains — is the most effective preparation strategy.
Ready to turn this knowledge into exam-ready confidence? Download Certcy free and start practicing ISC2 CC questions across all five domains today. With 110+ expert-written questions, AI-personalized study plans that adapt to your weak spots, and gamified learning that keeps you motivated, Certcy is the study partner that meets you wherever you are — online or offline. You’ve got this.
Ready to Pass Your Certification?
Practice with 1,890 expert-written questions across 17 CompTIA, ISC2, AWS, and Cisco exams.
Free to start, no credit card required.